1. Field
The present inventive concept pertains to a system and method to decode obfuscated software. The present inventive concept more particularly concerns a system and method to programmatically runtime de-obfuscate intentionally obfuscated software via virtual machine introspection and manipulation of virtual machine guest memory permissions.
2. Discussion of Related Art
The information security industry routinely seeks to reverse engineer malicious software to determine what malicious behaviors could have been executed on compromised hosts. This process involves the step of taking executable code of the malicious software and disassembling or decompiling to take a higher level view of its functionality.
Reverse engineering malicious software is made more difficult by the standard practice of malware authors of obfuscating executable code as malicious binaries to prevent analysis. According to existing obfuscation strategies, executable code of the malicious software is encoded in a way that makes it unrecognizable as executable code by a disassembler or analyst attempting to perform manual analysis of the malicious software. This process is commonly referred to as “packing.” At runtime, when the malicious software executes, the obfuscated executable code of the malicious software is programmatically decoded and then executed. This process of attempting to turn the obfuscated executable code into the form that will be executed is referred to as “unpacking.”
At present, there are hundreds of different publicly available software libraries and algorithms that are commonly used by malware authors to accomplish obfuscation. Many of these obfuscation strategies utilize tools which can help make obfuscated code appear different for each unique instance on each infected computer system, for example random number generators.
There are presently a limited number of tools available to detect and de-obfuscate malicious code, but these tools are only effective where certain strategies were used to accomplish obfuscation. These tools are of limited, if any, efficacy in de-obfuscating code obfuscated by other strategies. As a result, the process of analyzing many instances of obfuscated software is often a time consuming, difficult, and manual process that requires specialized reverse engineering expertise. Thus, there is a need for an improved system and method operable to programmatically decode obfuscated software thereby providing increased efficiency.